Is there a way to get Alert from adding lookup in query?

[DougiieDee]

I am trying to get the alert when Excerption error happens but there are many hosts and services. In splunk the services and host arent arranged so manually I added the service name and hosts in csv file. is there a way or similar condition to get log events saying this serivce is getting error is this host with the message

[venkatasri · Accepted solution]

@DougiieDee You can use lookup command prior to that you CSV shall be configured as lookup first assuming you did this already.

You SPL would something like this, when you say Message i hope you are referring to original event itself that's an _raw field in Splunk. host is the the common field hence you output your service. <lookup_name> and <your_search> are just place holders you have to replace them.

<your_search> 
| lookup <lookup_name> host OUTPUT service 
| table host service _raw

--

An upvote would be appreciated if this reply helps!

[DougiieDee]

Thank you worked perfectly. Also is there a way to limit the message like only take first 200 words?

[venkatasri]

@DougiieDee 

 | head 200      should work.

[venkatasri]

Hi @DougiieDee 

Can you explain bit more easily to understand.

[DougiieDee]

i have a csv file which has host and service. In splunk host is there but not service. i wanted to search with the csv file so it displays as service host and message when the event happened. is there a way to do it?